{"id":17881964,"url":"https://github.com/amine7536/elastalert-rpm","last_synced_at":"2025-03-22T11:31:21.860Z","repository":{"id":23198685,"uuid":"98404750","full_name":"amine7536/elastalert-rpm","owner":"amine7536","description":"Automated Centos7 RPM build of Elastalert - Easy \u0026 Flexible Alerting With Elasticsearch.","archived":true,"fork":false,"pushed_at":"2022-12-27T14:58:25.000Z","size":10288,"stargazers_count":1,"open_issues_count":15,"forks_count":8,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-18T11:04:19.385Z","etag":null,"topics":["ansible","centos","docker","docker-image","elastalert","elasticsearch","inspec","kitchen-ci","rpm","systemd"],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/amine7536.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-07-26T09:23:23.000Z","updated_at":"2025-02-25T12:25:06.000Z","dependencies_parsed_at":"2023-01-13T22:55:36.779Z","dependency_job_id":null,"html_url":"https://github.com/amine7536/elastalert-rpm","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amine7536%2Felastalert-rpm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amine7536%2Felastalert-rpm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amine7536%2Felastalert-rpm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amine7536%2Felastalert-rpm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/amine7536","download_url":"https://codeload.github.com/amine7536/elastalert-rpm/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244951437,"owners_count":20537385,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","centos","docker","docker-image","elastalert","elasticsearch","inspec","kitchen-ci","rpm","systemd"],"created_at":"2024-10-28T12:46:23.646Z","updated_at":"2025-03-22T11:31:21.519Z","avatar_url":"https://github.com/amine7536.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Elastalert RPM Build repository [![Build Status](https://img.shields.io/travis/amine7536/elastalert-rpm/master.svg?style=flat-square)](https://travis-ci.org/amine7536/elastalert-rpm)\n\nAutomated Centos7 RPM build of Elastalert [http://elastalert.readthedocs.io/en/latest/](http://elastalert.readthedocs.io/en/latest/) \n\n## Stack\n- Elastalert [http://elastalert.readthedocs.io/en/latest/](http://elastalert.readthedocs.io/en/latest/)\n- FPM Packaging tool : [http://fpm.readthedocs.io/en/latest/](http://fpm.readthedocs.io/en/latest/)\n- KitchenCI / Inspec : [http://kitchen-ci.org/](http://kitchen-ci.org/)\n\n## Usage\n\nThe build script `build.sh` create a python `virtualenv` to install `elastalert` then uses `fpm` to package the entire virtualenv into an RPM. The script works on centos7.\n\n### Build\n\n```bash\n$\u003e docker run -v $(pwd):/build -it centos:centos7 /build/build.sh\n...\n\n$\u003e rpm -qp --info /build/elastalert-0.1.18-1.el7.x86_64.rpm\nName        : elastalert\nVersion     : 0.1.18\nRelease     : 1.el7\nArchitecture: x86_64\nInstall Date: (not installed)\nGroup       : default\nSize        : 50901525\nLicense     : Apache 2.0\nSignature   : (none)\nSource RPM  : elastalert-0.1.18-1.el7.src.rpm\nBuild Date  : Thu Jul 27 12:06:02 2017\nBuild Host  : c90b33846cbd\nRelocations : /\nPackager    : amine.benseddik@gmail.com\nVendor      : @c90b33846cbd\nURL         : http://elastalert.readthedocs.io/en/latest\nSummary     : ElastAlert - Easy \u0026 Flexible Alerting With Elasticsearch.\nDescription :\nElastAlert - Easy \u0026 Flexible Alerting With Elasticsearch.\n```\n\n### Configuration\n\nEdit the file `/etc/elastalert/config.yml` :\n\n```yml\nrules_folder: /etc/elastalert/rules\nes_host: localhost\nes_port: 9200\nwriteback_index: elastalert_status\nrun_every:\n  minutes: 1\nbuffer_time:\n  minutes: 10\n```\n\nDon't forget to run for the 1st run : `$\u003e elastalert-create-index`  \n[http://elastalert.readthedocs.io/en/latest/running_elastalert.html](http://elastalert.readthedocs.io/en/latest/running_elastalert.html)\n\n### Start\n\n```bash\n$\u003e systemctl start elastalert\n```\n\n## Run KitchenCI/Inspec test\n\nYou will need `ruby`, `bundler` and `docker` installed on you system. A `Vangrantfile` is provided for convinience.\nKitchenCI configuration can be found in the file `.kitchen.yml` :\n\n```yml\n---\ndriver:\n  name: docker\n  use_sudo: false\n\nprovisioner:\n  name: ansible_playbook\n  hosts: test-kitchen\n  roles_path: roles\n  ansible_verbose: true\n  require_ansible_repo: true\n  require_ansible_omnibus: false\n  require_chef_for_busser: false\n  require_ruby_for_busser: false\n\nverifier:\n  name: inspec\n\nplatforms:\n  - name: centos-7.3\n    platform: centos\n    driver_config:\n      image: local/c7-systemd\n      run_command: /usr/sbin/init\n      port: 22\n      volume: \n        - /sys/fs/cgroup:/sys/fs/cgroup:ro\n        - \u003c%=ENV['PWD']%\u003e:/build\n\nsuites:\n  - name: default\n\n```\n\n### Docker with *systemd*\n\nAs this package is meant to be used on Centos7 we need to enable *systemd* inside the Docker container used by KitchenCI. This can be done using the dockerfile `systemd.Dockerfile` :\n\n```Dockerfile\nFROM centos:centos7\n\nENV container docker\n\n# Enable Systemd\nRUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == \\\nsystemd-tmpfiles-setup.service ] || rm -f $i; done); \\\nrm -f /lib/systemd/system/multi-user.target.wants/*;\\\nrm -f /etc/systemd/system/*.wants/*;\\\nrm -f /lib/systemd/system/local-fs.target.wants/*; \\\nrm -f /lib/systemd/system/sockets.target.wants/*udev*; \\\nrm -f /lib/systemd/system/sockets.target.wants/*initctl*; \\\nrm -f /lib/systemd/system/basic.target.wants/*;\\\nrm -f /lib/systemd/system/anaconda.target.wants/*; \\\nrm -f /usr/lib/tmpfiles.d/systemd-nologin.conf;\nVOLUME [ \"/sys/fs/cgroup\" ]\nVOLUME [\"/run\"]\n\n# Start\nCMD [\"/usr/sbin/init\"]\n```\n\nMore information can be found on the official Centos7 docker image repos : [https://github.com/docker-library/docs/tree/master/centos](https://github.com/docker-library/docs/tree/master/centos)\n\n\n### Running the tests\n\nBefore running the tests we need to build the base docker image with *systemd* :\n\n```bash\n$\u003e docker build --rm -t local/c7-systemd -f systemd.Dockerfile .\n```\n\nThen run the tests :\n\n```\n$\u003e bundle install\n$\u003e bundle exec kitchen test all\n\n...\nProfile: tests from {:path=\u003e\"/vagrant/test/integration/default/inspec\"}\nVersion: (not specified)\nTarget:  ssh://kitchen@localhost:32768\n\n  ✔  elastalert-1: Elastalert: Check RPM Installation\n     ✔  System Package elastalert should be installed\n     ✔  User elastalert should exist\n     ✔  User elastalert group should eq \"elastalert\"\n     ✔  User elastalert home should eq \"/usr/share/python/elastalert\"\n     ✔  User elastalert shell should eq \"/sbin/nologin\"\n     ✔  Service elastalert should be installed\n     ✔  Service elastalert should not be enabled\n     ✔  Service elastalert should not be running\n     ✔  File /etc/elastalert/config.yml should exist\n     ✔  File /etc/sysconfig/elastalert should exist\n     ✔  File /usr/lib/systemd/system/elastalert.service should exist\n\nProfile Summary: 1 successful, 0 failures, 0 skipped\nTest Summary: 11 successful, 0 failures, 0 skipped\n\n```\n\nA simple *ansible* playbook is used to install the rpm in kitchen docker image and the `Inspec` test are located under `test/integration/default/inspec`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famine7536%2Felastalert-rpm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Famine7536%2Felastalert-rpm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famine7536%2Felastalert-rpm/lists"}